CVE-2026-114742

The WPVR WordPress plugin (versions 8.3.0 - 9.0.2 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The software fails to perform object-level ownership checks when updating virtual tours. This allows users with contributor-level access and above to modify, reconfigure, and publ...

tours.desert360virtualtours.com Cross Site Scripting vulnerability OBB-3851410

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

tours.hawaiianvirtualtours.com Cross Site Scripting vulnerability OBB-3844874

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...